LinkFlow: Efficient large-scale inter-app privacy leakage detection

Android enables inter-app collaboration and function reusability by providing flexible Inter-Component Communication (ICC) across apps. Meanwhile, ICC introduces serious privacy leakage problems due to component hijacking, component injection, and application collusion attacks. Taint analysis technique has been adopted to successfully detect potential leakage between two mobile apps. However, it is still a challenge to efficiently perform large-scale leakage detection among a large set of apps, which may communicate through various ICC channels. In this paper, we develop a privacy leakage detection mechanism called LinkFlow to detect privacy leakage through ICC on a large set of apps. LinkFlow first leverages taint analysis technique to enumerate ICC links that may lead to privacy leakage in each individual app. Since most ICC links are normal, this step can dramatically reduce the number of risky ICC links for the next step analysis, where those ICC links are matched among leaky apps. We develop an algorithm to identify privacy leakage by analyzing ICC links and the associated permissions. We implement a LinkFlow prototype and evaluate its effectiveness with more than 4500 apps including 3014 benign apps from five apps marketplaces and 1500 malicious apps from two malware repositories. LinkFlow can successfully capture 6065 privacy leak paths among 530 apps. We also observe that more than 400 benign apps have vulnerabilities of privacy leakage in inter-app communications.